home/headers/x-frame-options

X-Frame-Options

response headersecurity

Controls whether the page may be shown inside a frame, protecting against clickjacking.

Clickjacking hides your page in an invisible iframe on another site and tricks users into clicking it. X-Frame-Options tells the browser whether framing is allowed at all (DENY) or only by your own site (SAMEORIGIN).

Syntax

X-Frame-Options: DENY | SAMEORIGIN

Defined in RFC 7034 — HTTP Header Field X-Frame-Options.

Values

DENY	never allow the page in a frame
SAMEORIGIN	allow framing only by pages on the same origin
ALLOW-FROM <uri>	obsolete — ignored by modern browsers

Examples

X-Frame-Options: DENY

never allow framing

X-Frame-Options: SAMEORIGIN

allow your own pages to frame it

Good to know

CSP frame-ancestors is the modern replacement and can name specific origins: frame-ancestors 'self' https://partner.example.
When both are present, browsers that support frame-ancestors use it and ignore X-Frame-Options.
It does nothing in a <meta> tag — send it as a header.

Further reading: Security headers checklist · Security headers generator

How to set X-Frame-Options

Express

res.set("X-Frame-Options", "DENY");

Next.js (next.config.js)

module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "X-Frame-Options", value: "DENY" }],
      },
    ];
  },
};

nginx

add_header X-Frame-Options "DENY" always;

Apache (.htaccess)

Header always set X-Frame-Options "DENY"

Check it

Fetch only the response headers and filter for X-Frame-Options. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^x-frame-options:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

How do I let one specific site frame my page?

X-Frame-Options can't — ALLOW-FROM was dropped by browsers. Use Content-Security-Policy: frame-ancestors 'self' https://partner.example.